✨ Feature Suggestion | List PGP keys + proofs of recommendations somewhere? #1755

New Issue

jonah · 2020-03-03T15:29:25Z

Mikaela commented

2020-03-03 15:29:25 +00:00

(Migrated from github.com)

Description

A bit like https://github.com/privacytoolsIO/privacytools.io/issues/1622, we have multiple recommendations who are using PGP in code/software signing, sign emails they send or support PGP encrypted emails. https://github.com/privacytoolsIO/privacytools.io/issues/1703 would bring more of them, so I wonder if we should have a list of the PGP fingerprints (with a big warning to not solely trust us and do your own research)?

I think this might carry a risk of us becoming a pseudo CA though, while git makes all changes transparent (at least for those who look).

As with #1622, I have a personal "project" doing similar except that I am not bothering with proofs there. README

## Description A bit like https://github.com/privacytoolsIO/privacytools.io/issues/1622, we have multiple recommendations who are using PGP in code/software signing, sign emails they send or support PGP encrypted emails. https://github.com/privacytoolsIO/privacytools.io/issues/1703 would bring more of them, so I wonder if we should have a list of the PGP fingerprints (with a big warning to not solely trust us and do your own research)? I think this might carry a risk of us becoming a pseudo CA though, while git makes all changes transparent (at least for those who look). *As with #1622, [I have a personal "project" doing similar](https://gitea.blesmrt.net/mikaela/pgp-alt-wot/) except that I am not bothering with proofs there. [README](https://gitea.blesmrt.net/mikaela/pgp-alt-wot/src/branch/master/README.md)*

jonah commented

2020-03-09 03:02:39 +00:00

I think this might carry a risk of us becoming a pseudo CA though

This is my concern, especially because we will now be tasked with keeping it up to date with changes as well. If a project utilizes PGP they should also have a mechanism to securely transmit that key to the user on their own, IMO.

> I think this might carry a risk of us becoming a pseudo CA though This is my concern, especially because we will now be tasked with keeping it up to date with changes as well. If a project utilizes PGP they should also have a mechanism to securely transmit that key to the user on their own, IMO.

This repo is archived. You cannot comment on issues.